Privacy Policy

Mark Ferguson, trading as Trade Rank, 19 Larghill Lane, Ayr, KA7 3LS, United Kingdom is the data controller for personal data processed via the TradeRank app and website.

Contact: legal@trade-rank.co.uk

• Account: email address, password (hashed), display name, optional business name.
• Profile & business: trade, service area, avatar, bio, contact preferences.
• Content you post: marketplace listings and photos, gig postings, quiz username and scores, timesheet and job data.
• Financial: invoices, purchase invoices, CIS/VAT settings, mileage; bank account metadata (bank name, masked account number, balances) from open-banking connections via GoCardless BankData. We do not store your online-banking password.
• Integrations: OAuth tokens for Google Business Profile and Google Search Console when you connect them.
• Communications: messages you send through the marketplace inbox or contact form.
• Technical: IP address, user agent, referring URL, pages visited — only when you consent to analytics (PostHog). Necessary session cookies work regardless.

• Contract (Art. 6(1)(b) UK GDPR): to create your account, deliver the app's features, take payment, and provide customer support.
• Legitimate interests (Art. 6(1)(f)): to secure the service, prevent abuse and fraud, moderate marketplace content, and improve reliability. You can object at any time.
• Consent (Art. 6(1)(a)): optional analytics cookies and any marketing emails. You can withdraw consent at any time in the footer's "Cookie preferences" or the unsubscribe link in any marketing email.
• Legal obligation (Art. 6(1)(c)): retaining invoices and tax records where UK law requires it.

We use trusted service providers ("processors") to run the app. A live list is on our Subprocessors page. We do not sell your personal data.

We may disclose data if required by law, a court order, or to protect rights, property or safety.

Our primary database and file storage are hosted in the EU (Stockholm region) on Lovable Cloud (Supabase). Some processors — for example Cloudflare's global edge network, Stripe, Resend, PostHog and Google — may transfer or process personal data outside the UK/EEA. Where they do, we rely on the UK's adequacy decisions, the UK International Data Transfer Agreement, or Standard Contractual Clauses.

• Account and profile data: while your account is active.
• After you delete your account: content is removed and residual copies age out of routine backups within 30 days.
• Invoices, purchase invoices and tax-relevant records: retained (with personal identifiers minimised) for 6 years to comply with UK tax law.
• Security and abuse-prevention logs: up to 12 months.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to erase your data ("right to be forgotten")
• Ask us to restrict or object to certain processing
• Ask for a portable copy of the data you gave us
• Withdraw consent for analytics or marketing at any time
• Lodge a complaint with the UK's Information Commissioner's Office (ico.org.uk)

You can exercise access, portability and erasure yourself from Settings → Privacy. For anything else, email legal@trade-rank.co.uk. We aim to respond within 30 days.

We do not make solely-automated decisions that produce legal or similarly significant effects about you.

TradeRank is intended for UK tradespeople and business owners aged 18 or over. We do not knowingly collect data from children.

See the Cookie Policy for the specific cookies we set, what they do and how to change your preferences.

We'll update the "Last updated" date at the top of this page when we change the policy. Significant changes will be flagged in-app.